Statement of commitment

In advance of each Information Management Assessment (IMA) we recommend that Permanent Secretaries publish a statement of commitment to the IMA process that also underlines the importance of good practice in information and records management. HM Treasury (HMT) has not published a statement of commitment. However, the Second Permanent Secretary and Senior Sponsor for Knowledge and Information Management (KIM) within the department, John Kingman, visited The National Archives in August 2015 to demonstrate his commitment to the IMA process and to working with us.

Information Management Assessment background

HMT first underwent an IMA in 2010. The 2010 IMA report can be found on The National Archives’ website at nationalarchives.gov.uk/information-management/manage-information/ima/ima-reports-action-plans/

HMT committed to an IMA reassessment, which was conducted in September 2015. The reassessment entailed a detailed review of supporting documentation, followed by interviews with senior staff, specialists and practitioners in the department’s London office. These were carried out on 9 and 10, 14 and 15, and 21 September.

The following report provides a summary of good practice and risks identified. IMA reports and departmental action plans are published on The National Archives’ website at: nationalarchives.gov.uk/information-management/our-services/ima-reports-action-plans.htm Glossary

AC – Advisory Council CIO – Chief Information Officer CTO – Chief Technology Officer DRO – Departmental Records Officer EDRM – Electronic Document Records Management EMB – Executive Management Board ERM – Electronic Records Management FOI – Freedom of Information GIAA – Government Internal Audit Agency GOGGS - Government Offices Great George Street GRS – Government and Remote Services GPS – Global Positioning System HMT – Her Majesty’s Treasury IACSEP – Information Assurance and Cyber Security Engagement Programme IAO – Information Asset Owner IAR – Information Asset Register IM – Information Management IMA – Information Management Assessment IMC – Information Management Consultant IWS – Information Workplace Solutions ORG – Operational Risk Group KIM – Knowledge and Information Management KM – Knowledge Management PST – Personal Storage Table RM – Records Management SCB – Strategy and Capability Board SCS – Senior Civil Service SIRO – Senior Information Risk Owner Key findings of the assessment

1 The value of information

| Performance rating | | |--------------------------------------------------------|----------| | Communicating and realising value | Good practice | | Managing information as an asset | Development needed |

Situation at the time of the last Information Management Assessment (IMA) in 2010:

Senior leaders tended to engage with information management issues by exception rather than on a routine basis, opting to delegate to more junior grades, and there was no permanent representation at Board level.

In terms of culture, there was a broad understanding of the importance of information management in HM Treasury (HMT). However, it was perceived as an add-on and the preserve of more junior grades. HMT had high staff turnover and there was a tendency towards team autonomy.

- Senior support for Knowledge and Information Management (KIM) at HMT is among the best we have seen in the government departments we have assessed and marks a big improvement since the last IMA. HMT has appointed a Senior Sponsor for KIM, the Second Permanent Secretary, John Kingman. He is personally involved with the Knowledge Management (KM) benchmarking and is keen to support and lend his name to KIM messages. The HMT Permanent Secretary, Sir Nicholas Macpherson, also actively supports the KIM agenda. All senior staff we spoke to felt they had good access to the Permanent Secretary, Second Permanent Secretary and the Board, and KIM staff provide regular briefings to them. • The Records Management Policy clearly sets out the responsibilities and expectations of all staff for record keeping and is supported by clear and easy-to-follow guidance on how to do this. The majority of staff we interviewed recognised the value of information and the need to keep records and save them to Info Store, HMT’s corporate system for managing digital records. This is particularly important given the high staff turnover in the department.

• HMT has a clear strategy for improving information and records management. The inclusion of KIM as an integral part of the wider Information Workplace Solutions (IWS) Strategy 2015-20 should help to ensure that KIM goals are effectively aligned with those of IT and Security. This has been signed off and endorsed at SCS level.

• There is a good process in place for managing Freedom of Information (FOI) requests and its figures are satisfactory. HMT is proactively publishing information on GOV.UK and data.gov.uk but should consider the possibility of making more information/data available.

• HMT’s approach to information asset management needs to be improved. The department does not have an Information Asset Register and there is no formal reporting on information assurance. HMT would benefit from further developing its approach to information asset management in order to gain greater control of its information assets. Since the IMA, the department has set up an HMT Board Briefing on information assurance and cyber security in March 2016. A presentation from the Information Assurance and Cyber Security Engagement Programme (IACSEP) at an SCS meeting will follow. This will serve as a good starting point for taking this work forward. See recommendation 1.

2 Digital information and supporting technology

| Performance rating | | |--------------------|---| | Supporting information through technology | Satisfactory | | Digital continuity and IT change | Satisfactory | Situation at the time of the last Information Management Assessment (IMA) in 2010:

An electronic records management system, JIGSAW, was in place, but few teams used it to manage their records, often using the system retrospectively. There were issues around the reliability and stability of the system and it was unclear whether funding would be available to upgrade it. HMT were also looking into the possibility of using Microsoft SharePoint for managing digital records at the time of the IMA. There were generous storage limits in place for email, providing little incentive for staff to move important emails to JIGSAW, so they tended to manage their emails within their Outlook inboxes.

- HMT has made good progress in putting in place a system, Info Store (based on SharePoint 2010), to manage its digital information. Despite issues around the rapid rollout, take-up of the system appears to be good. Staff interviewed were broadly positive about using it, despite one or two minor points, which is a considerable improvement on the situation with JIGSAW at the time of the last IMA. Interviewees were particularly positive about the ease of transferring emails into Info Store. There are, however, some issues around the structure and access permissions and Info Store does not yet have capability for full lifecycle management: for example, disposal has not yet been applied to records within the system. All of these issues are being addressed through the Information Management project, which aims to redesign the SharePoint Electronic Document Records Management (EDRM) system to implement better policy compliance and enable digital preservation. See recommendation 2.

- HMT was one of the earliest adopters of digital information in government and while this brings benefits – such as a much more joined up approach between KIM and IT for the management of digital information – it also means that HMT has a large amount of ageing digital information. It is important that this information is maintained (kept complete, available and usable) for as long as HMT needs it, that information of historical value is identified and transferred to The National Archives, and that information is disposed of if it has no continuing value. Again, this is being addressed through the Information Management project. See recommendation 2.

- The Information Management project is hugely important for ensuring that HMT progresses to where it needs to be in managing its digital information. It is essential that each stage of the project goes ahead as planned and that it continues to have the support and investment that it needs. See recommendation 2.

3 Information risk, governance and oversight

| Performance rating | |------------------------------------| | Recognising information risk | Development needed | | Establishing control | Satisfactory | | Providing guidance | Good practice | | Measuring Impact | Good practice |

Situation at the time of the last Information Management Assessment (IMA) in 2010:

Comprehensive guidance on Knowledge and Information Management (KIM) and induction training was in place but this was not necessarily being consistently followed across the business. The department had not progressed far with what to keep and had only rolled this out to one Directorate at the time of the assessment.

- HMT could do more to embed information risk within its Risk Management Framework. There is no overall description of information risk within HMT and there does not appear to be a shared understanding of what this actually means across the organisation. The department needs to develop a description of information risk that reflects that it is about more than physical loss of information or cyber-attacks but is also about the ongoing availability and integrity of information; it also needs to communicate this to staff. HMT should ensure that senior management and Information Asset Owners (IAO) understand the importance of identifying and managing information risk and of the negative impact if information is not managed and protected appropriately. The KIM and Information Security teams do regularly report on information-related risks to the Operational Risk Group (ORG), which is a positive step. The IACSEP briefings referred to in section 1 will also help raise awareness. See recommendation 3.

- HMT has recently established an Information Management (IM) Steering Group that meets every two months. It is chaired by the Departmental Records Officer (DRO) and the Head of KIM, and membership includes the Chief Technology Officer (CTO) and representatives from Internal Communications, IT Services, Knowledge Management, Site Owners, IT security and technical specialists. At the time of the IMA it was too early to judge the effectiveness of the steering group. However, this is a positive step in terms of facilitating formal interaction between all of the key information management stakeholders. HMT has established effective networks of Knowledge Champions and Site Owners in business areas. The Knowledge Champion role has proved to be particularly successful and plays an important role in the Knowledge Management (KM) benchmarking process and in improving KIM practice in business areas. The role of a Site Owner is similarly crucial in terms of managing use of Info Store. HMT should review the role to establish how it should change or be strengthened in view of the need to work with an enhanced Info Store. See recommendation 2.

- HMT has recently updated its Records Management Policy and this is reflected in a succinct, easy-to-read and up-to-date set of guidance for staff on how to manage information and records. A selection of KIM training is also provided, including a range of sessions on Info Store and more general sessions on KIM. All staff are expected to complete KIM induction training.

- HMT has done excellent work in developing an effective way of measuring compliance with KIM policy across the organisation. The KM benchmarking has proved to be successful in getting business areas to improve KIM practice as well as raising the profile of KIM across the department and providing an opportunity for KIM staff to have face-to-face contact with teams. HMT should continue to invest time and effort in this and think about how it can continue to develop and strengthen the approach for the future – for example, encouraging continued improvement in those areas that are already scoring highly and thinking about other useful metrics that could be collected as part of that process. See recommendation 4.

4 Records, review and transfer

| Performance rating | |--------------------------------------------------------| | Oversight of records and selection | Satisfactory | | Implementing disposal decisions | Development needed |

| Situation at the time of the last Information Management Assessment (IMA) in 2010: | |-----------------------------------------------------------------------------| | HMT was slightly behind schedule in assessing its paper files to determine whether they should be permanently preserved and transferred to The National Archives under the 30-year rule. It also needed to consider the implications of the transition to the 20-year rule. |

- The Departmental Records Officer (DRO) has a high profile and is performing all of the functions of the role as detailed by The National Archives. The outsourcing of paper records storage and appraisal and selection of paper records appears to be working well, despite some initial difficulties. There are no particular concerns about resource at the moment, although there was recognition that the success of KIM at HMT is very dependent on the Knowledge Champions and Site Owners.

______________________________________________________________________

1 nationalarchives.gov.uk/about/our-role/plans-policies-performance-and-projects/our-projects/20-year-rule/ across the business. If their involvement were to change, there would be more pressure on the KIM team to carry out these tasks. The DRO and KIM team have an excellent working relationship with The National Archives.

- HMT is aware that it is currently behind in transitioning to the 20-year rule. The department submitted a paper on this to the Advisory Council (AC) in 2015, detailing the reasons for the delay and a plan for improvement. This was approved, a Retention Instrument is in place and HMT is currently on track with its transfer plan. See recommendation 6

- As with most other government departments, the biggest challenge facing HMT is how to appraise, select, apply disposal criteria, sensitivity review and transfer its digital information. HMT has already made good progress in starting to develop an approach for this through its Information Management project. The department is fully engaged with The National Archives’ Digital Transfer User Group, which will enable it to follow and learn from The National Archives and other government departments’ work on this, as well sharing its own knowledge and experience. See recommendation 5.

## Highlights table

The following are among the areas of good practice identified at the time of the assessment. They include systems and approaches that other government organisations may find helpful in mitigating information and records management related risks:

| Highlights of the 2015 Information Management Assessment | |---------------------------------------------------------| | The Second Permanent Secretary, John Kingman, is the Senior Sponsor for Knowledge and Information Management (KIM) within HM Treasury (HMT). He is personally involved with the Knowledge Management (KM) Benchmarking, including presenting awards to top performers and meeting with the directors and deputies of low-scoring business areas that need to improve practice. He was instrumental in refreshing the KIM unit and identifying new KIM leadership, and interviewees reported that he is keen to lend his name to and support KIM messages. He also visited The National Archives in July 2015, prior to the IMA reassessment, further demonstrating his commitment to the KIM agenda. The HMT Permanent Secretary, Sir Nicholas Macpherson, also actively supports the KIM agenda. All senior staff we spoke to felt that they had good access to the Permanent Secretary, Second Permanent Secretary, and the Board. |

HMT has a good process in place for managing Freedom of Information (FOI) requests. These requests are handled by business areas but a central FOI team coordinates this through case advisors, who provide advice and support, and monitor progress. They also hold weekly FOI surgeries with representatives from the FOI team and legal experts, which staff can attend to discuss issues. Advice given by the FOI team can range from intensive support on handling complex cases to wider discussions with policy teams. regarding withholding information. There is a range of FOI guidance available on HMT’s intranet, Red Box. FOI requests are tracked using E-case, HMT’s system for tracking correspondence, and records kept on Info Store, HMT’s corporate system for managing digital records. E-case can be used to look at performance by team and identify bottlenecks in order to offer more support to business areas that need it.

Email is the primary tool used to conduct business and share information within HMT. It is very easy to transfer emails into Info Store and the Automated Intelligence Syncpoint software is used to facilitate this. The majority of staff we spoke to highlighted how simple it was to move their emails to Info Store – there was a lot of positivity among interviewees on this. HMT staff are encouraged to file emails ‘as they go’, rather than transfer large batches at once.

HMT has recently documented requirements for the Information Management Project and the next iteration of its records management system. The Records Management (RM) Systems Requirements bring together mandatory records management requirements and business user input. They cover metadata, file plans, search, access permissions, retention and disposal, triggers for disposal and transfer to The National Archives.

HMT has established a network of Knowledge Champions who are responsible for raising the profile of KIM and encouraging good practice, as well as playing an important role in the KM Benchmarking, helping to gather evidence for their business area and facilitating the review meetings. The Knowledge Champions we spoke to were enthusiastic, proactive and took their responsibilities as Champions seriously. There are also monthly meetings for Knowledge Champions where they can discuss issues and share best practice.

All staff are expected to complete face-to-face induction training in KIM. Two sessions are provided. One is run in the form of a quiz that conveys KIM messages and tests staff knowledge in a fun and interactive way. The other session provides a more formal, high-level view, addressing the business and compliance value of KIM.

HMT has developed a really solid approach to measuring compliance with KIM policy through the KM Benchmarking. This is a self-assessment process: each business area scores KIM activities against a maturity model which describes what has to be achieved against each score. The assessments are carried out in hour-long team meetings. The Knowledge Champion facilitates the assessment and a member of the Knowledge and Information Management team moderates the session. Teams provide evidence of good practices to support the scores achieved. Scoring is on a scale of 1 to 5 (1 aware, 2 first steps, 3 defined, 4 managed, 5 embedded), although scores of 0 can be given in exceptional circumstances. Business areas that are not performing well have to repeat the process and if they don't improve, they have to meet with the Second Permanent Secretary to explain why. Results for 2014-15 show an overall improvement across the organisation. Following the benchmarking, business areas are expected to produce an action plan to demonstrate how they are going to improve practice.

# Recommendations to address risk areas

## Recommendation 1

**HM Treasury (HMT) should further develop its approach to information asset management to gain greater control of its information assets.**

This would be supported by:

- Defining what an information asset is for HMT.
- Considering how HMT can best document its information assets, drawing on the work that the Knowledge and Information Management (KIM) team is doing to survey and document the digital information that the department holds.
- Developing a method of reporting on assurance of these assets and linking this with the benchmarking process already established for Knowledge Management (KM).
- Defining the Information Asset Owner (IAO) role and considering how this can be better supported through training, guidance and networks.

## Recommendation 2

**HMT should build on the work it has done so far and continue to develop its approach to the management of both current and legacy digital information.**

This would be supported by:

- Ensuring that the Information Management Project stays on track and continues to have the support and investment that it needs.

- Addressing issues around structure, access permissions and disposal as part of the Information Management Project.

- Gaining a greater understanding of staff practice on the shared and personal drives and in managing email through monitoring and increased reporting, possibly as part of the KM Benchmarking.

- Decommissioning any shared drives that are unnecessary to ensure maximum up of Info Store.

- Making sure that IT is involved when business areas want to use collaboration and other web tools. Including rules about the use of these systems and capture of record content in the Records Management Policy and related guidance, and effectively communicating these to staff.

- Raising staff awareness of how to optimise search within Info Store through guidance and the help of the KM Champions and Site Owners.

- Reviewing the Site Owner role to evaluate whether the right people are carrying out this function and considering how many Site Owners are needed. Ensuring that the requirements of the role are reflected in Site Owners' performance objectives, as it is for the Knowledge Champions.

- Continuing to embed the use of Info Store across the organisation through communications, training, guidance and the help of the KM Champions and Site Owners.

- Further consideration of what digital information HMT can proactively release and engaging with end users to see what would be of value.

- Where additional tools are used by business areas, ensuring that IT is involved in their installation and use; making sure that rules about the use of these systems and capture of record content are included within the Records Management Policy and related guidance, and that these are communicated to staff.

**Recommendation 3**

**HMT needs to improve its approach to managing information risk within the wider HMT risk management framework.**

This would be supported by:

- Putting together a description of information risk asserting that information risk is not only about physical loss of information or cyber-attacks, but is also about the ongoing availability and integrity of information and communicating this to staff.
- Ensuring that senior management and IAOs understand the importance of identifying and managing information risk, and the negative impact if information is not managed and protected appropriately through briefings and training.

**Recommendation 4**

**HMT should continue to invest time and effort in supporting and further developing the KM benchmarking:**

This would be supported by:

- Thinking about how the process will be developed to challenge and motivate high-scoring business areas to continue to drive improvement.

- Exploring whether the process can be used to gather more detailed evidence of information and records management practice in business areas – for example, around use of Info Store, shared and personal drives, filing of emails, and so on.

- Considering whether information assurance reporting can be linked or incorporated into this process.

**Recommendation 5**

**HMT should continue to build on the positive work it has done so far in developing an approach for the appraisal, selection, sensitivity review and transfer of digital information.**

This would be supported by:

- Building up a full picture of HMT’s digital holdings.
- Applying disposal criteria to legacy and current digital records.
- Developing a method of appraising digital records including the use of Series Level Appraisal Questionnaires (SLAQ).
- Devising an approach to sensitivity reviewing its digital information.
- Deciding how it will transfer digital information and testing this.
- Continuing to engage with The National Archives’ Information Management Consultant (IMC) and Digital Transfer User Group.
- Sharing knowledge, experience and learning from other government departments; testing and piloting different approaches.
- Publishing guidance on what to keep and/or retention or disposal schedules on GOV.UK.

**Recommendation 6**

**HMT should continue making positive steps in the management of its paper records, including appraisal, selection and transfer.**

This would be supported by:

- Ensuring that HMT keeps on track with its transfer plan as agreed by the Advisory Council (AC).
- Carrying on work with The National Archives’ Government Remote Services (GRS) team on requisitioned records.
- Continuing its good work in managing the relationship with external contractor/s carrying out management of paper records and accelerated review. 1 The value of information

1.1 Communicating and realising value

Goal: The organisation establishes information’s value in principle and supports its realisation in practice.

Establishing the importance of information

Senior support for and engagement with Knowledge and Information Management (KIM) at HM Treasury (HMT) is among the best we have seen in the departments we have assessed. The Second Permanent Secretary, John Kingman, is the Senior Sponsor for KIM within HMT. He is personally involved with the Knowledge Management (KM) Benchmarking, including presenting awards to top performers and meeting with the directors and deputies of low-scoring business areas that need to improve practice. He was instrumental in refreshing the KIM unit and identifying new KIM leadership. Interviewees reported that he is keen to lend his name to and support KIM messages. He also visited The National Archives in July 2015, prior to the IMA reassessment, further demonstrating his commitment to the KIM agenda.

The HMT Permanent Secretary, Sir Nicholas Macpherson, also actively supports the KIM agenda. Interviewees reported him to be interested in the historical record and very knowledgeable on the history of HMT. All senior staff we spoke to felt that they had good access to the Permanent Secretary, Second Permanent Secretary and the Board. The Senior Information Risk Owner (SIRO) is managed by the Permanent Secretary and has regular meetings with him. Both the Chief Information Officer (CIO) and Departmental Records Officer (DRO) have been called in to brief the Permanent Secretary on issues such as digital records and the Goddard Inquiry. He has also pledged his support for the Information Management Project. This is good practice. Unfortunately, we were not able to secure an interview with a Non-executive Director – part of our standard interview process – and so could not test KIM awareness and engagement from their external and challenge perspective.

The annual KM Benchmarking process (see section 3) has helped to raise the profile of KIM with senior management. It has tasked senior management with responsibility for promoting the importance of managing knowledge, information and records and for improving practice in their business areas. The directors and deputy directors we spoke to recognised the importance of this and were actively involved in completing the benchmarking and producing action plans; they were committed to improving performance in their business areas. The benchmarking has also raised awareness of the importance of good KIM practice in business areas.

HMT has recently refreshed its Records Management Policy, which clearly sets out staff responsibilities for KIM and expectations around record keeping:

*The Treasury Board has overall responsibility for ensuring that Department record keeping meets business needs, Government standards and legal requirements.*

- **Deputy Directors** are responsible for the completeness, security and overall effectiveness of record keeping in their area, including oversight of their team file plan. They are the **Information Asset Owners** for all the data managed by their teams.

- **Info Store Site Owners** are appointed by Deputy Directors to administer their local Info Stores. Site Owners are specially trained and have access to a range of guidance and support in order to manage local access permissions, site features and record keeping functions, including the maintenance of a team file plan. All Treasury staff are responsible for reliable record keeping on behalf of HM Treasury: you will understand and use Info store; you will file regularly; you will file selectively; you will file securely; you will refrain from excessive personal storage. If you are unclear about any of this, you will seek advice.

Record keeping is important at Treasury and, as a result, team performance is monitored and reported back to SCS, most notably through the annual Knowledge Management Benchmarking exercise.

There are a number of pages on the intranet that cover KIM basics and information on record keeping. These include information on staff members’ responsibilities for managing their information, what should and shouldn’t be kept as a record, where records should be kept, and how they should be managed. The Record Keeping Essentials document states that:

We keep records for three reasons: first, because our information has business value; second, because we’re heavily scrutinised and need to be able to explain and justify our actions: third, because what Treasury does makes history and we have a statutory duty to deposit some of our records with The National Archives.

We keep records which provide reliable evidence of the decisions that we make, the advice that we give and why. We keep a full account then, of all Treasury decisions, advice and transactions including not only the final document in each process (say the submission, briefing, contract or minute) but evidence of the significant consultations, drafting, negotiations and other activities that led up to it.

The majority of staff we spoke to recognised the importance of keeping records within Info Store, HMT’s dedicated system for Electronic Records Management. (ERM). Many cited the high turnover of staff in the department: around 20%, with staff often moving on after 18 months. Take-up of Info Store appears to be high with most interviewees saying that they used it, although a small number of teams are reportedly still using the shared drives.

**Setting goals for information and its management**

HMT has an Information Workplace Solutions (IWS) Strategy 2015-20 and KIM is an integral part of this. The strategy has been signed off and endorsed at SCS level. It states that:

> In Knowledge and Information Management we will drive better record keeping and information sharing through upgrading our tools and working hand-in-hand with the business to help them gain control of their information. We will help Treasury to increasingly exploit the opportunities offered by new web applications, supporting innovation, whilst ensuring that our data stays integral and secure. Throughout all this the statutory agenda will remain in focus. We will help ensure that Treasury complies with the Public Records Act and can reliably meet legal discovery requirements in an increasing litigious environment.

The strategy will be translated into a business plan that is closely aligned with departmental objectives and the wider external environment.

The IWS strategy and business plan is governed by the IWS Executive Board, chaired by HMT’s Finance Director (an Executive Management Board (EMB) and Strategy and Capability Board (SCB) member) with senior customer representation from within the wider business and the Corporate Centre Group. The IWS Executive Board reviews and manages risks to delivery of the service; ensures customer centric service delivery; resolves issues; approves/rejects changes to the strategy and business plan; and authorises the engagement with the HMT’s SCB.

The strategy states that the following activities will help to achieve their knowledge and information goals: • Working with Government Internal Audit Agency (GIAA) to help them achieve an information approach that sustains a digital legacy into the future.

• Supporting all staff to develop an information repository that works for them and their teams.

• Upgrading our core knowledge management platform, SharePoint. We will migrate to the very latest version of the software and add enhancements to improve user acceptance and experience, and to ensure that we can meet current and future requirements, including for long-term record keeping.

• Building capability across the Treasury to ensure that users get the most out of tools for sharing, searching, finding and analysing information, both internal and external including the increasing use of low-cost, highly-functional Web applications. This will include training, guidance and support for our communities of Knowledge Champions and Site Owners.

• Continued delivery of the annual KM Benchmarking exercise and the development of the measures that underpin it, to reflect evolving business needs and our growing KM maturity.

• Staying on top of our statutory responsibilities notably the transfer of historic Treasury records to the National Archives [sic]. Over the next few years this will include our first digital transfers and we will meet this technical challenge with no compromise in compliance.

The inclusion of KIM within the wider IWS strategy should help to ensure that KIM is effectively aligned with IT and Info Security, which are also covered by this strategy. The activities listed are already part of the KIM plan for 2015-16 and many of them form part of the Information Management project.

Enabling public access to information and supporting transparency and re-use

HM Treasury has a good process in place for managing Freedom of Information (FOI) requests. These requests are handled by business areas but a central FOI team coordinates them through case advisors, who provide advice and support, and monitor progress. They also hold weekly FOI surgeries with representatives from the FOI team and legal experts, which staff can attend to discuss issues. Advice given by the FOI team can range from intensive support on handling complex cases to wider discussions with policy teams regarding withholding information. There is a range of FOI guidance available on Red Box, HMT’s intranet. Staff interviewed were aware of this, although at least one expressed a preference for face-to-face advice from the team, which they found to be very helpful. **This is good practice.**

FOI requests are tracked using the E-case correspondence tracking system and records kept on Info Store, HMT’s corporate system for managing digital records. E-case can be used to look at performance by team and identify bottlenecks in order to offer more support to business areas that need it. The FOI team has wide search access and can, for example, search the whole of Info Store. The team has a lot of experience at searching and can provide support to business areas in carrying out searches in response to FOI requests. One interviewee said that, although Info Store search functionality could be better, in that it could be easier to find what they need, they are comfortable that it provides a reasonable search capability. They also felt that the advanced search functions in Info Store are helpful. The FOI team would like to be able to export search results from Info Store into Excel and is speaking to the KIM team about this. In addition, two case advisors within the FOI team have access to confidential records stored on the Number 10 system for managing confidential digital information.

HMT’s FOI figures are satisfactory but, according to one interviewee, they are striving to improve these. HMT reported having received 275 requests in Quarter 1 2015. The number of requests received has fallen steadily since 2013 from a peak of 779 in Quarter 1 2013. Of those received in Quarter 1 2015, 85% met the 20-day deadline and 92% were answered ‘in time’ (meeting the deadline or within permitted extension). From Quarter 1 2013, HMT has consistently achieved a figure of over 90% answered ‘in time’ for every quarter. In Quarter 1 2015, 30% of resolvable requests were granted in full: this is below the average for all monitored bodies (49%). Additionally, 42% were withheld in full: this is above the average for both departments of state (33%) and all monitored bodies (32%). As of 24 September 2015, there were 1,866 publications by HMT on GOV.UK, 369 of which were classed as transparency data, 63 were FOI releases and 367 corporate reports. The department has published 46 datasets on data.gov.uk. The website gives HMT an average score for openness of 1.9 out of 5 and it has received a total of 88 stars. HMT could do more to publish data proactively and there are already discussions underway to consider what else HMT could make available. The majority of information that HMT holds is unstructured policy information and there is a limit as to how much of this can be made available. One interviewee also suggested a study of common FOI queries to see if proactive publication of information would be of benefit. There was a strong feeling that datasets published should be of genuine value and the data itself of robust quality. HMT should be engaging with end users to see what would be of value. See recommendation 2.

1.2 Managing information as a valued asset

Goal: The organisation protects, manages and exploits its information assets to achieve maximum value.

Defining and cataloguing information assets

HMT does not follow a traditional approach to information asset management, at least in the way it is described in the Security Policy Framework. It does recognise information as a valuable asset (see section 1.1) but manages this through its approach to KIM and the KM Benchmarking exercise.

There is no definition of what an information asset is for HMT and this has led to some confusion around the term, particularly among Information Asset Owners (IAOs). The majority of information within the department is unstructured policy information rather than datasets, and those we interviewed were not sure how a traditional information asset management approach could be applied. HMT does not have a formal Information Asset Register, although it does have a list of SharePoint sites, file-shares and the mailboxes of each Treasury team. There is no comparable list for structured information assets. The department needs to find a way of articulating what business assets are important, and where the risks are in relation to these, which goes beyond a systems view. There is no formal reporting on information assurance. In most government departments we have assessed, Information Asset Owners (IAO) complete an annual report in relation to their information assets that feeds into the annual report required under the Security Policy Framework. The HMT Departmental Security Officer and KIM team are in discussions about how this could be developed.

HMT would benefit from further developing its approach to information asset management to gain greater control of its information assets. It is recommended that HMT defines what an information asset is and considers how it can best document its information assets, drawing on the work that the KIM team is doing to survey and document the digital information that the department holds. This would help IAOs to have a clearer idea of the assets for which they are responsible. HMT should also develop a process of reporting on the assurance of these assets. This could link with the KM Benchmarking process.

Ownership of information assets

Deputy Directors are IAOs. Their responsibilities in relation to KIM are well defined but not in terms of information asset management. Minimal support is provided to IAOs. There are links to wider government guidance on information assurance and information asset management on Red Box. Deputy Directors meet regularly at their Senior Civil Service (SCS) meetings, but are not using this opportunity to talk about information assets/information assurance. At the time of the IMA, HMT had not yet taken up the offer of IAO training from the Information Assurance and Cyber Security Engagement Programme (IACSEP) team at The National Archives, although certainly some of the deputy directors and the SIRO we spoke to expressed an interest in this. However, HMT has since arranged a Board Briefing on information assurance and cyber security in March 2016 with a presentation from IACSEP at an SCS meeting to follow. There are no official roles – such as Information Asset Managers or Coordinators – to support the IAOs, but there are well-developed networks of Knowledge Management Champions and Site Owners that support them in their KIM duties.

2 Information and supporting technology

2.1 The technology environment

Goal: The technology environment supports the management, protection and exploitation of information.

Corporate storage of information

Electronic Document and Records Management (EDRM)

HMT has recently moved to a new core IT supplier (NTT), having split from a shared service IT arrangement with Cabinet Office. It exited its previous EDRM, JIGSAW (based on LiveLink software), and has now implemented Info Store (based on SharePoint 2010). HMT was planning to adopt Info Store for some time but the actual implementation happened quickly over a period of three months. This meant that there was a lack of time to focus on cultural or business change activities such as training. Despite this, take-up of the system appears to be fairly good, and is certainly an improvement on the situation found during the IMA in 2010 with JIGSAW. Staff seem to be happy to use it, despite a few issues around search and structures.

At present, Info Store does not have the capability for full lifecycle management. For example, disposal has not been enabled. However, HMT has plans to address this and the Information Workplace Solutions (IWS) strategy 2015-20 states that HMT will be: Upgrading our core knowledge management platform, SharePoint. We will migrate to the very latest version of the software and add enhancements to improve user acceptance and experience and to ensure that we can meet current and future requirements, including for long-term record keeping.

HMT has set up an Information Management Project to:

- address the digital legacy (from the first EDRM in 1996 until the move to the latest in 2013, plus orphaned data on file shares) and move it all into line with The National Archives Gateway 1 for appraisal and selection
- redesign the SharePoint EDRM to implement better policy compliance (by design) and enable digital preservation.

HMT has recently documented requirements for the Information Management Project and the next iteration of its records management system. The Records Management (RM) Systems Requirements bring together mandatory requirements, records management requirements and business user input. They cover metadata, file plans, search, access permissions, retention and disposal, triggers for disposal and transfer to The National Archives. This is good practice.

Email

Email is the primary tool used to conduct business and share information within HMT. It is very easy to transfer emails into Info Store and the Automated Intelligence Syncpoint software is used to facilitate this. The majority of staff we spoke to highlighted how simple it was to move their emails to Info Store; there was a lot of positivity among interviewees about this. So far, HMT seems to have avoided the problems associated with bulk transfer that other government departments have experienced. This may be because HMT staff are encouraged to file emails ‘as they go’ rather than transfer large batches at once. This is good practice. There are clear rules about the deletion of email when people leave HMT. The Records Management Policy states that:

*All the emails of Treasury staff are deleted 10 days after staff leave. This is the generic data policy for email…Only transferring your email messages and documents to Info Store will properly preserve them as the Department’s records.*

The high turnover of staff at HMT raises the risk that important emails may not be filed before people leave the department and subsequently deleted. However, the ease of getting emails into Info Store, paired with raising awareness through training and guidance, should serve to mitigate this risk. HMT would benefit from having a greater understanding of what staff are doing with their emails in practice and could potentially do this through the KM benchmarking. This would help HMT to target further training and support for those that need it. See recommendation 4.

Although most staff we interviewed did not use Personal Storage Table (PST) files (file format used to store copies of messages, calendar events, and other items within Microsoft software), these have been an issue in the past. HMT addressed this by increasing the size of email accounts to 10GB and encouraged people to migrate PSTs to their Microsoft Outlook account. One interviewee felt that staff had been using PSTs more as a ‘security blanket’ and this did not necessarily mean they were not saving emails into Info Store.

**Shared and personal drives**

Shared drives remain accessible and contain around two and a half terabytes of data. However, the majority of staff we spoke to were not using shared drives. We heard from one or two interviewees that a few teams are still using them in lieu of moving to Info Store. In addition, a small number of staff members will always need access to a shared drive for use of linked spreadsheets as they cannot be moved to Info Store. Although it can get statistics on the volume of data they contain, HMT currently lacks the ability to see what staff actually do on shared drives. As with email, HMT would benefit from gaining a greater sense of practice in this area through either monitoring or reporting tools. See recommendations 2 and 4.

Shared drive use seems much less widespread than in other departments we have assessed. However, while they remain accessible there is always a risk that staff will revert back to using them, particularly if there are ever any significant technical issues with Info Store. Staff we spoke to told us that switching off access to the shared drives is not yet part of the Information Management Project, although there appears to be an aspiration to make it more difficult to access the shared drives in order to deter staff from using them. The Records Management Policy states that:

*Shared drives (G drives and others) cannot easily meet the functional threshold required for managing records. However, during a transitional period until April 2016 we anticipate that a substantial amount of data will persist on file shares. During this time the following arrangements will apply:*

- Documents stored on shared drives will be systematically moved by IWS into Info Store on a team by team basis. On migration, mandatory indexing information and an appropriate retention policy will be added; in as far as this is possible.
- During this process, redundant, duplicate and otherwise worthless documents (i.e. expired non-records) will be deleted.
- No new file shares will be allocated without a business case (to be approved by the Departmental Records Officer) from August 2015.

Any file storage that remains on file shares beyond April 2016 will be formally declared and registered by the Departmental Records Officer. Where this storage contains records it must be managed in broad accordance with HMT records policies and on closure, files must be migrated by IWS to Info Store in order to be processed for National Archives transfer. In addition to the plan described above, it is recommended that HMT decommissions any shared drives that are not necessary to ensure maximum take-up of Info Store. See recommendation 2.

All staff have access to a personal drive; as with email, personal drives are subject to clear rules around deletion. The Records Management Policy states that Personal H drives are deleted 30 days after staff leave HMT. Most staff we spoke to only used their personal drive to store documents of informational/personal value to them or as a temporary filing area for drafts, which they later transferred to Info Store. Again, there is a risk that documents may not be transferred to Info Store before staff leave the department. However, the ease of getting emails into Info Store, paired with raising awareness through training and guidance, should serve to mitigate this risk.

Intranet

HMT’s intranet is called Red Box. Based on a demonstration, we saw it was easy to navigate and there were good pages on KIM and Information Security. The majority of staff we spoke to used Red Box and were satisfied with it. It is currently being redesigned and an updated version will be launched soon.

Collaboration and other tools

Until now, HMT has had a fairly conservative approach towards the use of collaboration tools, preferring to use email instead (see above). HMT is using SharePoint predominantly as a filing tool and is not using it in a particularly dynamic way as of yet. The KIM team aims to encourage staff to use the collaboration functionality within Info Store and the team is trying to showcase these features – setting up a blog, a discussion forum and wish lists for the Site Owners Forum. Other business areas are slowly starting to pick up on this: for example, the Human Resources team now writing a regular blog. HMT has recently opened up wider access to web tools and this presents a challenge in terms of keeping track of what is being used and ensuring that any record is captured. Some concern was expressed about the fact that business areas can sign up for services and do not always tell IT. There was a desire to try and centralise this as much as possible. Computer desktops and infrastructure are locked down so staff are not able to install apps. IT is also trying to control the development of random databases and spreadsheets. If these types of tools are to be used more, HMT needs to ensure that IT is involved in their installation and use. Rules about the use of these systems and the capture of record content need to be included within the Records Management Policy and related guidance, and these need to be communicated to staff. See recommendation 2.

Finding, accessing and protecting information

Business areas create and maintain their own filing structures within Info Store. Site Owners are responsible for maintaining and controlling these file plans. Many of these structures originate from the original Electronic Document and Records Management System (EDRMS), JIGSAW. These structures were migrated to help introduce an element of familiarity to staff when moving across to Info Store. However, since then each business area has been asked to review and update its file plan. The KIM team has been monitoring this and will be chasing those that have not yet done this. We were shown a random selection of filing areas and, although all slightly different, they seemed sensible and well organised. However, we heard during some of the interviews that some business areas have created their own complex mini filing areas, which can appear impenetrable to staff outside those business areas. One business area has also introduced a ‘mystery shopping’ approach of checks to see if its staff members could find records in other teams’ filing areas. The Information Management Project will address this by assessing the structure as a whole and introducing more consistency. See recommendation 2.

Default access permission within Info Store is 'HMT all read access' and this is inherited throughout the file plan. Site Owners can set 'read write' access groups for their areas and add members to these. There is also an 'owners' access group that gives administrative privileges. It is possible to set up controlled areas where the default is that no one can see the contents, and it is possible to add members and specific access permissions. It is also possible to lock down folders, which involves ‘breaking the inheritance’ and setting up controlled permissions. This has caused a level of complexity with permissions in some filing areas and occasionally documents that should be closed are in areas that are open, and vice versa. The KIM team is aware of this issue and it will be addressed as part of the Information Management Project. HMT has procured a tool called Metalogix to give it a ‘back end’ view of the whole security landscape within Info Store so it can see where security inheritances have been broken and put these right. See recommendation 2.

Many staff we spoke to complained about search functionality within Info Store. Several had an expectation that a Google-style approach of typing in a keyword should help them quickly find what they were looking for. However, a demonstration of the search function revealed that this was more to do with a lack of understanding among staff of how to get the best out of searching within Info Store rather than any technical shortcomings. The search function enables users to select the scope of their search and they can search using keywords. Search results helpfully display in order of relevance. It is also possible to use a Boolean search. This involves using Boolean operators AND, OR and NOT to refine a search by combining or limiting terms. It is done using the search box or a user can open up a more advanced search with various options to refine results. At the moment, it is not possible to export search results into Excel or elsewhere – the FOI team has said that they would find this useful and the KIM team is addressing this issue. It is also not yet possible to output all searched-for documents into a separate library, a function that is useful for Inquiries or other investigations – a scripted solution will be needed to make this happen. It is recommended that the KIM team, through the KIM Champions and Site Owners, raise staff awareness of how to optimise search within Info Store by using the advanced search options or Boolean searching. See recommendation 2. 2.2 The continuity of digital information

Goal: The organisation is taking proactive steps to ensure the continuity of its information, over time and through change.

Oversight of information

HMT moved to digital earlier than many government departments (its first EDRM system, Panagon, dates back to 1996) and as a result has a substantial amount of ageing legacy digital information – approximately six terabytes. Part of the Information Management Project is to deal with this legacy digital information. HMT’s view of its digital information is improving: for example, it has a good idea of what is on Info Store. Some of the information on the shared drives has yet to be surveyed but this will be tackled as part of the Information Management Project.

Information from the old HMT EDRMs, Panagon and JIGSAW, has already been migrated to the Number 10 ‘confidential’ version of Info Store. The Information Management Project will develop an approach for the appraisal and selection, ongoing maintenance and disposal of this information and that on the shared drives. HMT has carried out some initial tests on format and found a few WordPerfect documents that could not be opened, although the majority of formats were accessible. HMT assured us that, as far as they were aware, there were no issues with exporting information from the Number 10 ‘confidential’ version of Info Store. See recommendation 2.

Digital continuity planning/IT change

IT and KIM are positioned within the same business area, IWS. They work closely together and there appears to be a good working relationship between the two. HMT was one of the earliest adopters of digital records in UK government and has not created any significant paper files since 1998. As a result, information management is seen as ‘digital’: there isn’t a paper and digital split of the kind we see in other government departments. Contracts and procurement are part of IWS too and have a similarly close working relationship with KIM. The KIM team has the opportunity to feed in its view as a matter of course in relation to IT procurement and contracts. HMT does not have a standalone digital continuity plan but this is in scope as part of the Information Management Project. This is a positive move, but HMT should ensure that digital continuity is built into business-as-usual processes. For example, formulating a more consistent way of documenting information assets would better equip HMT to keep track of its digital assets. See recommendation 1. 3 Information risk, governance and oversight

3.1 Recognising information risks

Goal: The organisation defines and manages information risks to minimise threats and maximise opportunities

Documenting and defining information risks

There is no overall description of information risk within HMT and there does not appear to be a shared understanding of what this actually means across the organisation. In order to ensure that information risks are consistently identified, it is recommended that HMT puts together a description of information risk and communicates this to staff. This description needs to reflect that information risk is about more than the physical loss of information or cyber-attacks, but is also about the ongoing availability and integrity of information. An understanding of information risk should form part of training and guidance for IAOs (see section 1.2). See recommendation 3.

There is no risk register at HMT. Instead, risks are reported and managed via quarterly updates to the Operational Risk Group (ORG). Sample reports from KIM and Information Security were included in the evidence provided for the IMA. KIM and Security reports are submitted to every ORG meeting. The KIM risk report for July 2015 states risks, mitigations and milestones. Risks and issues were listed as:

- Document security in Info Store continues to be an issue. Short of the wholesale revision envisaged in the Info Store business case above, remedial action will be partial and heavily dependent on manual input by business Site Owners.
- The Goddard Inquiry (into historic child abuse) has extended its embargo over the destruction of HMG records to electronic archives (post 1996 in our case) ahead of clarifying the scope of the documentary evidence that it will consider. A flurry of FOI requests from journalists has followed the revelation in the FT that Cabinet Office enforces a 90 day deletion policy on email inboxes. Requests from the BBC amongst others imply that deletion is mandated to avoid scrutiny.

The security risk report for the same period lists the following risks and issues:

- **Key security issues; Government Offices Great George Street (GOGGS) physical security (the armed attacks across the world); the new Security Policy Framework; the cyber security threat; the insider threat; the wider use of the internet (including social media); and refining the new Government Security Classifications guidance and the drop down menu.**

- **Group business continuity preparedness being inadequate.**

There is a high-level Catalogue of Risks, but this is not regularly updated and there is no ‘Red Amber Green’ status or mitigation attached to each of these.

**Implementing an information risk management approach**

There are three risk areas within HMT – economic, fiscal and operational – and each of these has a formal risk committee. Information risk is part of the latter. The Risk Management Framework as a whole is overseen by the Audit Committee. The ORG, along with the Economic and Fiscal Risk Groups, supports the Executive Management Board in managing risks to HMT's portfolio of responsibilities, as set out in the department’s Annual Work Programme. The group is chaired by the Second Permanent Secretary and meets every quarter or more frequently if necessary. According to the HMT Risk Management Framework document:

*The Treasury’s identification and management of risk is based in part on management information; annual business plan assessments including six monthly* reviews; the development of the Treasury’s Work Programme; the Quarterly Performance Report; and HR and Finance Management Information.

As mentioned above, KIM and Information Security regularly report on information related risks to the ORG. However, according to one interviewee, although risk in general is very important to the HMT Board, information risk is low down the agenda. HMT should ensure that senior management and IAOs understand the importance of identifying and managing information risk and of the negative impact if information is not managed and protected appropriately. The IACSEP briefings referred to in section 1.2 will act as a good starting point for this. See recommendation 1.

HMT has taken all necessary steps to ensure that its systems are resilient from a security point of view. More concern was expressed about possible cultural issues rather than technical or cyber-attack. For example, the high turnover of staff means that there is a risk that new staff might not fully understand how they should be protecting their information. However, there is a solid process in place for managing data loss incidents and guidance is provided that goes some way to mitigating this.

In 2014, HMT Internal Auditors reviewed and published a report on record keeping within the department. The review found a number of significant risks around systems used to capture and manage information; roles and responsibilities for information management; information retrieval; and the management of information risk. The recommendations were taken forward and a Corporate Memory follow-up of March 2015 shows that significant progress has been made in all these areas and this is reflected in the relevant sections of this IMA report. 3.2 Establishing control

Goal: The organisation has effective governance structures in place that foster communication and strategic planning.

Governance structures

HMT has recently established an Information Management (IM) Steering Group that meets every two months. It is chaired by the DRO and Head of KIM. Membership includes the Chief Technology Officer (CTO) and representatives from Internal Communications, IT Services, Knowledge Management, Site Owners, IT security and technical specialists. It will:

- Develop and own a list of strategic IM priorities, which will help clarify where we are, where we’d like to be and how we get there.
- Review new requirements for IM services and technologies and advise the Change Board, who will ultimately respond to them.
- Consider conflicts amongst business teams for change resource in order to assist decision making by the Change Board.
- Advise IWS on which IM approaches will work best in Treasury and steer the direction of training and support services to fit.
- Advise on communications messages to help ensure that IM is well understood and received across HM Treasury.
- Adjust its governance principles where appropriate.

At the time of the IMA it was too early to judge the effectiveness of the steering group but, according to the Terms of Reference it is hoped it will provide a reliable, formal interaction between all the key information management stakeholders. Supporting the business

The KIM team consists of six staff. It focuses on oversight and coordination of KIM at HMT and relies on the Knowledge Champions and Site Owners (see below) and its contract with third party provider, Iron Mountain (see section 4), to ensure that KIM activities are carried out in practice. The KIM at HMT page on Red Box makes it clear that everyone has responsibility for KIM stating that:

*Record keeping, handover, quality research, stakeholder engagement and all the other important elements of Knowledge and Information Management are delivered by YOU! Your input and understanding is absolutely crucial. The KIM team is here to support you.*

Current priorities for the KIM team include the Information Management Project (see section 2) and ensuring that appraisal, selection and transfer of paper records continues to remain on track with the agreed transfer plan (see section 4). This work is firmly aligned with the IWS Strategy.

Support networks

There are two key support roles for KIM, based in business areas. Each team has a Knowledge Champion (to support KIM monitoring and improvement) and each team also has an Info Store Site Owner (to help manage the local EDRM folders). In some cases it is the same person performing both of these roles. Training, guidance and support is provided by the KIM team for staff in these roles.

The Being a Knowledge Champion guidance states that they should be:

*an enthusiastic advocate of KM, who is able to coordinate KM activities and provide support for KM initiatives, monitor and report on the team’s progress, and work with other Knowledge Champions and the Knowledge Manager to develop good practices.* Their role is to:

- Attend and contribute to the monthly Cross Treasury Knowledge Champions meetings. Disseminate information from Knowledge Champions meetings to your team.
- Share effective knowledge management practice within your team, with other Knowledge Champions and with your Knowledge Manager.
- Act as an enthusiastic advocate of knowledge management best practice and challenge poor Knowledge Management behaviours.
- Raise Knowledge Management issues with your Deputy Director, at team meetings and at away days, making good use of the knowledge resources: stats, reporting, tools, etc.
- Provide help and advice on knowledge management to your team members. Answer questions your team has about knowledge management and related issues.
- Carry out knowledge management benchmarking working with your Knowledge Manager and Deputy Director. Capture and share your team’s best practices.
- Develop a knowledge management action plan, using the outputs of the benchmarking. Use the action plan to drive improvements in your team.
- Work with other knowledge networks e.g. Site Owners, Intranet Publishers, etc. to improve Treasury’s efficiency.
- Encourage use of the Research Library services for external information sourcing. Engage with your team regarding information needs and report back to the Research Library.
- Encourage innovation by actively promoting and disseminating new ideas.

As well as raising the profile of KIM and encouraging good practice, the Knowledge Champion plays a crucial role in the KM Benchmarking, helping to gather evidence for their business area and facilitating the review meeting. The Knowledge Champions we spoke to were enthusiastic, proactive and took their responsibilities as Champions seriously. There are monthly meetings for Knowledge Champions where they can discuss issues and share best practice, although not all attend these. As with most of these types of roles, it is done in addition to the day job, so there can be a challenge in juggling KIM activities with core work. Of those we interviewed, most were able to devote time to this work. The Deputy Directors we interviewed recognised the importance of the Knowledge Champions, as their work helps business areas to achieve good results in the KM Benchmarking. **This is good practice.**

Knowledge Champions work in support of their Deputy Directors (also IAOs), although they have no formally recognised role in terms of information assurance. HMT could consider the possibilities of using the role to support future work on information assurance reporting and information asset management. **See recommendation 1**

The Site Owner role is more practical. The Being a Site Owner document contains some sample objectives, although it is not mandatory for a Site Owner to have these as part of their performance objectives, and states that:

*A site owner is responsible for managing team sites, including:*

- Setting and maintaining permissions
- Site customisation
- Site promotion – to appropriate target audiences
- Compliance/ working practices
- Provide local support
- Team reporting. Monitoring usage and feedback
- Identify successor and handover on leaving
- Guidance to/Training of content contributors and approvers as appropriate
- Identify changes to Corporate Metadata/taxonomy
- Request new and updates to core templates
- Maintenance of site guide
- Intranet specific
- Responsible for structure, content, review and maintenance of the intranet
- Adding content providers and reviewers
- IT systems status report
- Set up info store libraries (following initial implementation and training) The Site Owner role is absolutely crucial in terms of embedding use of Info Store and encouraging staff to use it properly. Again, the Site Owners we interviewed were, on the whole, dedicated and enthusiastic. They were performing important tasks such as carrying out spot checks to see if colleagues were saving the right information, managing naming conventions and managing access permissions. The KIM team has recently recruited a member of staff to manage this network, providing guidance, support and advice on how to get the best out of Info Store in each business area. There are also bi-monthly meetings for Site Owners where they can get together to discuss issues and share good practice.

There are around 200 people currently in this role. Several of the staff we interviewed felt that this was far too many. The role seems to have been a victim of its own success, with some Site Owners being a little over-enthusiastic and creating their own complex filing areas. One interviewee suggested that it would be more helpful to have the role at group level. HMT would benefit from reviewing the role, to see whether they have the right people doing this and consider how many Site Owners they actually need. It is also recommended that it should be mandatory for Site Owners to reflect this work in their performance objectives, so that their hard work can be formally recognised and credited at performance reviews. See recommendation 2.

### 3.3 Providing direction

| Goal: The organisation gives staff the instruction they need to manage, protect and exploit information effectively. |

**Knowledge and information management policy and guidance**

HMT has recently revised its Records Management Policy to prepare for HMT needs in managing its digital information. The policy clearly sets out the responsibilities and expectations of all staff for record keeping and is supported by a clear, succinct and easy-to-follow set of guidance on how to manage information and records. This includes guidance on managing email, Freedom of Information (FOI), data protection, KIM basics and what to keep (see below). There is detailed guidance on how to use Info Store, which is helpfully divided into sections for new starters, regular users and Site Owners to help address their different learning needs. HMT has also produced some guidance on knowledge management. This includes guidance on creating handover notes and on knowledge capture and management more generally. This is considered to be particularly helpful, given the high staff turnover at HMT. KIM guidance is available on Red Box and staff members we interviewed had no particular problems finding it.

**What to Keep**

HMT has produced clear and easy-to-understand guidance on what to keep, which is available on Red Box. The ‘For the Record’ document states

*Government asks HM Treasury to do a number of things - to manage the national budget (1), control public spending (2), develop policy within the scope of Treasury's remit (3), support financial services (4), run the Department (5), including private offices (6) and play a role in the wider governance of HM Government (7). Each of these functions generates records that we must keep.*

It then goes on to describe at a high level the types of records that should be kept for each of these areas. The ‘What’s a Record’ guidance states that:

*You need to decide what information must be retained in order to provide an audit trail of evidence and to add to the corporate memory. This includes internal and external email exchanges and information submitted by third parties.*

This document also gives examples of what should be kept, such as: information created and received in decision making by HMT; information created and received to show the direction, key stages and outcomes of projects; and information created and received to manage HMT and government resources. HMT has not yet published any of its guidance on what to keep or its retention or disposal schedules on GOV.UK and should aim to do this. This is a requirement under the recommendations from Sir Alex Allan’s report on Records Review. See recommendation 5

Knowledge Champions and Site Owners play an important role in ensuring that this message is understood by staff in their business areas. Staff we interviewed mentioned the guidance and seemed to have a good idea of what records they should be saving on Info Store. Some business areas have even gone one step further and produced their own, more detailed versions of the guidance to ensure that staff are keeping the right records. For example, one had produced guidance on what fiscal records to keep, including submissions and email decisions.

Providing training

The high turnover of staff at HMT means that regular training is particularly important in order to ensure that business areas continue to manage their information and records as required. Generally, staff we interviewed had been on the training and were positive about it.

All staff are expected to complete face-to-face induction training in KIM. Two sessions are provided. One is run in the form of a quiz that conveys the KIM message and tests staff knowledge in a fun and interactive way. It includes multiple-choice questions, such as ‘how many Knowledge Champions are there and who is the Senior Sponsor for Knowledge Management?’ The other session gives a more formal, high-level view, addressing the business and compliance value of KIM. It also includes some useful top tips for staff (see below). This is good practice

1. Don’t leave it until Friday, file as you go
2. Don’t be a slave to email
3. Get to know your knowledge champion and site owner
4. Let people know who you are – look after your MySite profile
5. Explore our e-resources
6. Learn more about search and discovery

There is also face-to-face training on Info Store and an e-learning package. There are four different levels of training, devised to suit the varying needs of staff across the organisation: training for teams, one-to-one training, more detailed training for Site Owners, and tailored sessions for teams and Site Owners. More than one interviewee suggested that training had been rushed when Info Store was originally rolled out. HMT needs to ensure that, with the planned enhancements to Info Store, the training is updated to reflect any changes and that staff are retrained where necessary. See recommendation 2.

3.4 Measuring impact

| Goal: The organisation measures performance in practice and takes informed, risk-based action as a result. |

Measuring compliance with policy

The most important measure of KIM activity at HMT is the annual KM Benchmarking exercise, which is a major commitment for KIM and for HMT and has been running for the past five years. It is a self-assessment process where each business area scores KIM activities against a maturity model that describes what has to be achieved for each score. The assessments are carried out in hour-long team meetings. The Knowledge Champion facilitates their business area’s assessment and a member of the KIM team moderates the session. Teams provide evidence of good practice to support the scores achieved. Scoring is on a scale of 1 to 5 (1 aware, 2 first steps, 3 defined, 4 managed, 5 embedded), although scores of 0 can be given in exceptional circumstances. Business areas that are not performing well have to repeat the process and, if they do not improve, they have to meet with the Second Permanent Secretary to explain why. Results for 2014-15 show an overall improvement across the organisation. Following the benchmarking, business areas are expected to produce an action plan to demonstrate how they are going to improve practice.

Our interviews revealed a real sense of positivity towards the KM Benchmarking. It has proved to be a great opportunity to raise the profile of IM, a chance for the KIM team to be more involved with business areas and it clearly motivates teams. One interviewee said they were ‘impressed at how HMT was trying to do well with KIM; it was better than in other departments they had worked in.’ The benchmarking has encouraged a competitive spirit: results are published on the intranet, and business areas compete with each other to improve their scores. There is an award ceremony and an award is given to the top scoring business area by the Second Permanent Secretary. This is good practice.

Some interviewees felt the approach could be developed further and improved. For example, there has been a gradual upward curve in scores and HMT needs to think about how it is going to challenge and motivate business areas to continue to drive improvement. Several interviewees felt the process needed to be more evidence-based and that there could be more metrics gathered to show what was happening in practice. One interviewee questioned the consistency of the scoring as, when comparing their business area with another higher scoring area, they felt that it should have been marked higher. More than one interviewee felt that business areas had learned how to answer the questions to show them in a more positive light. Despite this, the KM Benchmarking is an excellent approach: HMT should continue to invest time and effort in it and explore these suggestions when considering how to develop the approach for the future. See recommendation 4.

Assessing progress against strategic goals

KIM staff have good access to the senior team at HMT. The SIRO is a member of the HMT Executive Management Board and Strategy and Capability Board. IM risks are reported regularly to the ORG and the Chief Information Officer (CIO) and the Head of KIM provides regular updates. The IWS strategy and business plan is: Governed by the IWS Executive Board, chaired by HMT’s Finance Director (an EMB and SCB member) with senior customer representation from within the wider business and Corporate Centre Group. The IWS Executive Board reviews and manages risks to delivery of the service; ensures customer centric service delivery; resolves issues; approves/rejects changes to the strategy and business plan; and authorises the engagement with the Treasury’s Strategy and Capability Board. 4 Records, review and transfer

4.1 Oversight of records and selection

Goal: The organisation understands the value of its records and can consistently identify those with enduring historical value.

Position of the Departmental Records Officer (DRO)

The DRO has a high profile within HMT, has a good working relationship with the SIRO and provides regular briefings to the Second Permanent Secretary and Permanent Secretary. The DRO is proactive and is fulfilling all aspects of the role as set out in The National Archives’ guidance.

Current priorities for the KIM team are around the Information Management Project, and keeping on track with the transfer plan. KIM activities are partially devolved within HMT, with KIM Champions and Site Owners responsible for managing knowledge, information and records in their own business areas and the process of storage of paper records and accelerated review contracted out to a third party provider, Iron Mountain. At the time of the IMA, there were no particular concerns around resource within the KIM team, although the DRO recognised that, if the business were to decide that it could no longer support the KIM Champion and Site Owner roles, that could cause difficulties, due to the increased workload. There were, however, no signs to suggest that this would be the case and the business areas we spoke to seemed to take their KIM responsibilities seriously.

Oversight, control and use of records

HMT has a full knowledge of paper records, and paper records holdings (on site and off site) are all fully listed. It has been able to provide accurate figures for the twice-yearly Records Transfer Report. The department’s knowledge of the digital records it holds is improving and the contents of the former EDRM systems and mapped shared drives are known. A proportion of legacy information on redundant shared drives is still ‘dark’ however, although is in scope for the Information Management Project.

Overall control of paper records appears to be good. Management and storage of paper records is contracted out to Iron Mountain, which has been providing this service to HMT for over ten years. There have been a few issues around the tracking and management of records requisitioned (records can be requisitioned for departmental business use or for the process of sensitivity review) from The National Archives. In particular, HMT has a number of records defined as ‘outstanding’ (out in the department for longer than six months), 15 of which have been with the department for longer than five years. However, the KIM team are actively working to process and return these records and have a good relationship with the Government and Remote Services (GRS) team at The National Archives. Any outstanding records that HMT cannot locate (following searches) should be declared as ‘misplaced in department.’ See recommendation 6

Staff we interviewed did not report any particular issues in terms of accessing paper or digital records, although the extent to which they are accessing legacy paper records appeared to be minimal, given that the department stopped producing paper records in 1998.

**Appraisal and selection**

HMT has an Operational Selection Policy (OSP 15 on The Control of Central Government Expenditure 1969-1997) and has produced detailed Record Selection Guidance that includes lists of records likely to be selected for transfer to The National Archives and a list of key economic events from 1982 to 1997. HMT has also developed detailed selection criteria relating to policy records, committee records and bilateral records. There are codes linked to these criteria that are used to support the decision to keep or destroy a file. The process of appraisal and selection is currently based on making keep/destroy decisions on a folder by folder basis. Files are selected using selection criteria and the basis of the file title. HMT uses Series Level Appraisal Questionnaires to gather information on a particular prefix of records, which includes an overview of the team that created the records within that prefix, and its place in the department’s structure. The department plans to adopt the same approach for digital records review and test it through the Information Management Project, though the volume of digital records may make this more difficult. See recommendation 5.

Some aspects of this work are contracted out to Iron Mountain. HMT’s KIM team oversees this process, managing the contract, providing detailed guidance and quality-checking the work before passing to The National Archives’ Information Management Consultant (IMC) for sign-off. Originally, both the paper storage and accelerated review work carried out by Iron Mountain were part of the same contract. HMT decided to split the contract and retender to avoid confusion between the two aspects of this work, making it clear exactly what was expected in terms of throughput. At the time of the IMA, the department was about to award the contract. If a new contractor takes on this work then HMT should take the time to build the process with them and to train and support staff to ensure that the quality of work does not decline, and it remains on target.

4.2 Implementing disposal decisions

Goal: The organisation understands the process for records disposal and consistently implements decisions in line with defined plans.

Triggers for disposal

The majority of HMT’s business records share a generic disposition rule – policy and private office records are reviewed after ten years with a view to selection for transfer to The National Archives or destruction. There are other records with more diverse retention requirements, notably corporate ones. There are ‘What to Keep’ schedules for this material and these are published on Red Box. In the Records Management Policy, records are divided into four categories that determine how they are managed, and retention/review periods are set for each of these:

There are four broad categories of documents at HM Treasury - Policy, Private Office, Corporate and Ancillary.

1.2 Policy documents describe the vast majority of our work and are the critical business material of nearly all our Groups. Policy documents often form part of a record, which means that they need to be managed carefully and preserved for a long time.

1.3 Private Office documents are the primary evidence of ministers’ and permanent secretaries’ activities. Private Office documents are also often part of a record.

1.4 Corporate documents are the substance of our governance, administration and resourcing as a Department and cover committees, HR, Finance, IT, procurement, projects and related activities. Corporate documents often form records too.

1.5 Ancillary material is everything that isn’t core to either our business or our central business support activities. It is of localised and short-term interest only and includes team administration and working and reference information. Ancillary documents don’t need to be kept for too long and will never become a part of our long-term record. Annex 1 provides more detail of the types of material in each category.

HMT has not yet applied disposal to its digital information. This will be addressed as part of the Information Management Project (see section 2). As HMT has relatively few retention categories, as described above, it should not be too difficult to apply these to digital information within Info Store, though it will prove more of a challenge to apply this to legacy digital information.

**Sensitivity review**

Most of the sensitive information in HMT’s records (approximately 60%) is owned by other government departments. HMT is dependent on other departments to carry out sensitivity review for this information and this can be time-consuming and cause delays. The KIM team is currently considering how it can improve the guidance and knowledge around sensitivity review for staff, and has been speaking to The National Archives and other government departments such as the Foreign and Commonwealth Office and Ministry of Department about this.

The main issue for HMT, as with the rest of government, is how to sensitivity review their digital information and the department needs to start developing an approach for this, given that its earliest digital information is due for transfer in 2016. HMT is fully engaged with The National Archives’ Digital Transfer User Group, which will enable them to learn from the work that other government departments and The National Archives is doing on digital sensitivity review. See recommendation 5

**Transfer and planning**

HMT recognises the importance of fulfilling its obligations under the Public Records Act. There is a specific goal in the Information Workplace Solutions strategy that states

‘To ensure statutory compliance, notably with the Public Records Act which requires both good records management and the preservation of historic Treasury archives’

The strategy also cites the move from a 30 to a 20-year rule and The National Archives’ Digital Transfer programme as drivers for this. HMT is currently behind schedule in terms of transitioning to the 20-year rule; however, it has devised a plan to address this. A paper was brought to the Advisory Council (AC) in February 2015 explaining that the transfer programme had fallen behind schedule; that the department is unlikely to catch up fully before 2023; and that they are setting out a plan for transfer. A further paper was presented to the AC in May 2015 detailing the work that HMT had done since then to:

- Revise the transfer plan to include details of the number of files in scope in each category, for each year.

- Further refine the delivery model by working with suppliers to find a way of resourcing transfer activity that balances the need for a good-quality service with the imperative of delivering it in a cost-effective way. The department is confident that it has a sustainable approach.

- Engage with the research community by involving historians in the archive selection approach and transfer priorities, and holding a transfer workshop with senior academics, jointly facilitated by HM Treasury, The National Archives and the Institute for Government.

A Retention Instrument was approved by the AC to cover these records. At the time of the IMA, HMT was successfully keeping to the transfer plan set out in the paper and should ensure that it remains on track with this in the coming years. See recommendation 6

The HMT KIM team is fully engaged with The National Archives and there is an excellent working relationship between the two organisations.